Re: [saag] Ubiquitous Encryption: spam filtering

["John R Levine" <[e-mail]>]

> The first last and only reason phishing is possible is that we use
> authentication credentials that we expect people to keep in their head,
> never write down and only ever give them to people who are trustworthy.

That's some of it, but I've seen malware that does MITM attacks to 
redirect transactions authenticated with uncompromised two-factor devices. 
If all of the pieces are used exactly correctly, you're pretty secure, but 
we know how likely that is in the long term.

Like I said about spam, it's a hard problem.  In spam, exempting people 
you know from spam filtering doesn't work.  Partly that's because the 
introduction problem is as hard as the spam problem, partly that's because 
it'll just push spammers toward using compromised legit accounts, 
something they do a lot of already.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.